home

finaltorrentsetup.exe

Gamog

Parukumor

The application finaltorrentsetup.exe, “Gamog Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Parukumor

Product:
Gamog

Description:
Gamog Setup

MD5:
fdddec5f0741e4ce169eb1009c5d4d5b

SHA-1:
e371fddb744d165a8abc4726db9486390e6cf124

SHA-256:
98d742e718dc6dc61cb606b0f788daa8b24ac60d88c3538ad2140da0bed2e2b0

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/28/2024 12:06:28 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.5.11.13

File size:
1019.2 KB (1,043,666 bytes)

Product version:
3.8

Copyright:
Application Installer

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\finaltorrentsetup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:iFvmfMQFGr2uLpduKYfFSljlfEiiXyGEP2ckOdwyf5qnh4a:goGr2uLnOefEpyGLqdwyf53a

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9205

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file finaltorrentsetup.exe has been seen being distributed by the following 17 URLs.

http://www.presentheadbody.com/c?x=vzwJkPa/hcoXbCbhmll2 pxQt923Q2T9s/kOMb6dG I=&c=PiyrWekGFgEu PQkKRpKvY0O1 6wa3JxThVrjvddRbrPaS8OTfans2JNxLvonpk8ZQ/WgWuuU7aQjo/XDrMuUUr4dlGG7Xx RC dZoMbiC pa s6EodchA5TSOdVFs opcizCMbM6E3eLYCmMXJKZjDDkZu7svChddlSC3UseMZ9L/WnSbDl/r8XEGuW/7qx&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.presentheadbody.com/WVl6OTRQVTExYUZGcFlWWkZPSFZoUjFoaWIySlBiR1pHZEVKMFlWSmtaMUJDZG5BM2FtOUdNbGRWTlZnNVRsa2xNMFFtWXowNVUxUnNRV05QUlV0Q1FVaHdTa3RGYkVWMWNsaFBTVlZ1UnpBeE0yTnhWbXBhYkZsemNtaE5VVU5uYm04eGFXbEZWRGx2VmpsVVpYSkhkVzVFY2xsNGF6VXhRVE5RYms1UGJuSlNORVZTVEVkalkxaDRVa2htWmtadE9XUnNNV3hRVkUwM2IwRjZiV2RKVGxkYWFWSnFOakU0YzFCaGFqazNVblpyZUdOWlYxaGtiM1pIZWs4bE1rWjNVa2RPUkhCV2VWRnROMUZwVVNVelJDVXpSQ1psUFRBbVpHOTNibXh2WVdSQmN6MUdhVzVoYkZSdmNuSmxiblJUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdVptbHVZV3gwYjNKeVpXNTBMbU52YlNVeVJtUnZkMjVzYjJGa2N5VXlSbTVsZDJWemRDNWxlR1U9

http://www.flashhostingapp.com/c?x=pPZDlbKwcd0CmaFCXJrKaPBlRLGTE1NZ0 rgtdDctvc=&c=MrK9DlzsHY8OEYucbuUgB8LTNw0wSmAjNB79sHKVulSJwrmdL63TAB1asiTdYAhFTgfw5WecZBbg0 RlJm6NK/D929aPAn4UoEridIa4LI1RPOjpJSNdTdHuRM2WagkaZ7r1oBzOKzi1SYjxlYkmFed87hL3/WWO9f1fgJWT3Gk2BkQhjiu0JnRdm5tMG3qi&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.flashhostingapp.com/WVl6OTRQVWhVVEdoRGIzWjBabUowVUhkdVQzbDRWbEpNTjNOSFFYUmlPWEpKUW01WE5YQWxNa0pqU1dWQkpUSkdNMXBySlRORUptTTlSMlEwYUZWSVNtWnpVbGN3VVVKUFFUbFJaazFCZUd0cFp6Z2xNa1k0VkdGM01VdEJRbGw0Y1hSek1TVXlSbFJJTkdNd04xVnZjVzlwYTJVMGJsTmFWbEV6Y2pkUk9FUkVRbk5rU0ZCVmMyNVBUek5XZW5rNEpUSkNSbXdsTWtaSlUzVjNWMUZKTkdFMVdFTkZhV2RwTkVWbFIzTnBOR1l3WlUxTVowZDVNbk5UVTJSVFVqRlhUMGxMTjBGVU0yZGxjM0o0VlU1SmIyMXpWbkUzY21jbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbWx1WVd4VWIzSnlaVzUwVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtWnBibUZzZEc5eWNtVnVkQzVqYjIwbE1rWmtiM2R1Ykc5aFpITWxNa1p1WlhkbGMzUXVaWGhs

http://www.presentheadbody.com/c?x=Vu1uzYtlU0xD ZMkgDIIs08SAqCr73kp7vsRrortTMI=&c=goH2sWE6ev0hrTAhuMZC9DukFToX2qo otpa9lRF2ALKHk592yeJiaCYXW95uhz3 WTrfZWFa jcYHQBEhdc1QhYAWyOKji2O/VQ4WxFM8IPKm2ehttw9FZcTMjetWKa0zoISVJKXa/vx6XqLfXvjc0ElNISXG0QjJziCtbzNJjQXiPHcKYQpBJV5pNfUalF&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.presentheadbody.com/c?x=rDkldug13aohj0oHxO8i/MT//6QzoekrnXSg OHHDBU=&c=1NpmoGPDv3FDubGI9uzv3R0QfkQuMHOoeIH7ex4s6C6B2F3NPOIg8bQdHhqya8JpSedXs80rESmjcGxYEF7fmTQUYx7ykM18SOhIwq0WUs0Ek6Hf41m15k2uLB65dB3yjr/Dru 5wm7QqQgl8cuAlCHQvDKRK1Bm7rjW3bpCLS52qln0NeLb 1JPLALl5yQm&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.bundlesheadsign.com/c?x=UQvDdYa6FtyreL9Br6pOduH1xKC2G5vHR847n8qfYaE=&c=XbgDvzA 1Bno5ZvK9TeZ05ik3tLLbnKvD5mOvQnJyFS1auBIqmSF7u271gfp cJgzSD9PKq9QSg8g9uANJB290e7Iv8bMzxlhLnrfxy0oiVPoSwWLOlMaCzi8K62W rPirYSebo7aHcDDQFvN92sQitw99zhw0Ye ZXft8hihvsby2WAG0swzJdh5RzW149U&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.conceptsguardbinaries.com/WVl6OTRQVEJrWWxKMmNFc3pXbEo1Vm1obGNHcHVSRWRIVUdWeU5FdzRTMjFZY1V4eVFqQnVSVlpuY2s5aVVqZ2xNMFFtWXoxeFFtWlhUbTQxVGtKaGRIY3hPSEZRUjJoU2RTVXlSazlYUjBoMVRYZFVabmxDVTBaSmJqbFBWbFk1WVhoaFVHNTJaWFU0WVVoNE5GUlJjbkJuSlRKQ1UxVkZOWGQ2TURWM1JXRm5Sa1ZwYmtOeVdtaHdSMDVMWlZKVFZWbGxkazgyVjNJbE1rSjBjMjF4VldkeFVWb3dhSE40TUVodmJUTjZNR3hSZUd0NlRETXdhWEZYUVRNMGRHVm5hU1V5UWxjbE1rSlVUbVJzWW5Wak1uTmhPVVozSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWnBibUZzVkc5eWNtVnVkRk5sZEhWd0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1bWFXNWhiSFJ2Y25KbGJuUXVZMjl0SlRKR1pHOTNibXh2WVdSekpUSkdibVYzWlhOMExtVjRaUT09

http://www.flashhostingapp.com/WVl6OTRQVlZXWXpoNWNXbERVRnAySlRKR1lWSk9jbU1sTWtaT1psRmhVVFU1UkhkNmJ6aGlSVTR4YmpKeVYzWTVaVzlqSlRORUptTTljV1ZUVHlVeVJuUjZOMjlvUlVoQkpUSkdkSGhIVWpKcGRrdEdhMHR6WTJ0MFVrdGFVakZzWkhKU2VFdHhKVEpDWmpSeVQwTmhhbEp6ZVUxdWRIZGxPVzlUVWpGNWVIVjVNRmxZYXpablRVWXpNVzFGWldaUFpXMU5aWGRGZVZaNFIwcDVheVV5UW5OdWJHZzVXWHBQY0hCaFJHTlVaVTF5YkVneFFVMXVkRlU1ZFVONFVYWkRjekZtWWxNelJ6VnhUakZPWWxaTFNESkxia3hOWTJjbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlSbWx1WVd4VWIzSnlaVzUwVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtWnBibUZzZEc5eWNtVnVkQzVqYjIwbE1rWmtiM2R1Ykc5aFpITWxNa1p1WlhkbGMzUXVaWGhs

http://www.presentheadbody.com/c?x=MyrcDGE NwJ8s7XhomGoQ iHMpiaw/zrox2YYBMJe4w=&c=Yk9SRoqbxLZZ9gh1O8ew0kHTKYXxKe9iyMxQ8Wj/0JPSFglnCNybWbYg1LnLCnieGMCNIoDeWPrpnzTP/w3Dwd2uhd4lRuGPqHGmShS EOP5lWTL6VzQQg8f41nWb75NgF7O6o4 Xr3eGQgO3npEJ0wyGx3M UgOS0RxFBDD4IsGjGWY3V2pK/0e69qpvhjm&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.bundlecentralsign.com/c?x=/30G09tpDEpuOjCwThDpUqBE EOkieBM8mCeJ0yka50=&c=Mw1/ o3OJ3u421I7ni0oeJDjNFqRkvRD6660ANO9e4O4/HztymZvchgiVVtZTpO4m19WtVDRzWqyO3O9wprW94yh4bdH05rv8raAZTWSXB6yt5/VszT1MIy3qfX1qkNvReXVLlS5HyH9 h1VVhXFfhVy9mz9IrNzUD1ue 7BP8EA7l8uIMLlyRCds0a6s26i&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.townhostbyte.com/WVl6OTRQU1V5UW5OMFNHTldSR1pWUkNVeVFsTklUVUZTWjJJd1JuUnplRWh4Y0hSb2RIWXpZVzV2VjFCNFRVNTNkek5CSlRORUptTTlObGMyT0dsdEpUSkNUMU54ZUZwQk5rSldNSE5PWVdKU1VqTlJKVEpDYkRGeWNEbEhkVFV5TnpCSWNpVXlRa3h3SlRKR2RtWkJXR3hzZVV0emJGUnhTbXgxWVcxME56Rk1aSEV5WVRGcldUQlFTM05aWkdRNWRIZEJjVnA2Y0VRM2F6SlliemtsTWtaWGFUUkhNbXRTTTIxaVFtZzFSVWROTTBsYWFqWXlaV05zZWlVeVJtUjJlVWhZV25WQlVGbDFhRVJMU2xaWFVWQnBiVFJvYW10TVUzTlJKVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFVacGJtRnNWRzl5Y21WdWRGTmxkSFZ3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVtYVc1aGJIUnZjbkpsYm5RdVkyOXRKVEpHWkc5M2JteHZZV1J6SlRKR2JtVjNaWE4wTG1WNFpRPT0=

http://www.presentheadbody.com/WVl6OTRQV1pzTjJReU9USjZaRzVTSlRKQ2VGTjNaV2RGSlRKR2JEaEJVblZ0TlZscGRYRjRSV1p4ZVRVbE1rSXhkMk0wVVdNbE0wUW1ZejFMTUVsaFJsWldKVEpDY1c4d015VXlSa0pNU2pWYUpUSkNNRlJaZDJwSE1ETk9KVEpDUTFaMk5HZzVZMnBtYVU5b1NsRkZRakVsTWtKcFdrNVZObVI0YmpZd1NWTjZNR2RoUVhodWF6ZHlibUV6TWxoUVNVUmhTRVoxTm5kbmRXTXhRMGhTV2pKNlkyZE1aVUo0WkRsbkpUSkdVMnhvUVdoeloxcEZUVWxZVG5ORVRqQlVNMHRhUW1KMVJHZEViRlpXWWtONFlYZE5KVEpDTnpCbU1rWjRSWFZJZHlVelJDVXpSQ1psUFRBbVpHOTNibXh2WVdSQmN6MUdhVzVoYkZSdmNuSmxiblJUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdVptbHVZV3gwYjNKeVpXNTBMbU52YlNVeVJtUnZkMjVzYjJGa2N5VXlSbTVsZDJWemRDNWxlR1U9

http://www.townhostbyte.com/WVl6OTRQVVU1ZG1OTmFHaDRTRzV0T0dGSVZraFJNRTlDZEdSQlZVTnFSMGRZVGswbE1rSmlUVVoyYTBVMVFtVnJNQ1V6UkNaalBUQnBNSFYyU0dORFNVeHRRVGh5YUhwUmIyOUlaalUwVDJveGNqaFVSM1JRUW01b1JIUkJVVUZYTW1aTlVWQndKVEpHVGpSclowaENZMUpFSlRKQ2EydHRObTl5WkUxWVRURkhhVzFuT1doTGIyTmlSVFVsTWtab05Xa3hSQ1V5UWxOYU0xUlBTbm94VGxBM1FqTnpkM2x3SlRKR0pUSkdkbFJyUmpCdU1USTNSMWhwYjFaTlNVRk1iRTQ0ZDJ0S09HTklSMjVCUm1sSVlWaFhkMVV5WlhGVlFTVXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejFHYVc1aGJGUnZjbkpsYm5SVFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VabWx1WVd4MGIzSnlaVzUwTG1OdmJTVXlSbVJ2ZDI1c2IyRmtjeVV5Um01bGQyVnpkQzVsZUdVPQ==

http://www.flashhostingapp.com/WVl6OTRQWE42TTBWUVRucHhUek5DSlRKQ01YbDBObG94U1ZablMydEdjMEpRWjNRekpUSkdiM3BIT0ZkSVIzSmFOSE5ySlRORUptTTlOV1YwUWxwWkpUSkNUMVJ5WjJGUFJqazRURFZGUjNvNFZXcFRiR05aV2paTGNtTTVXbXhhVXpKQ1VXdFpRamxsWlU4NFMySnVTRGhGVkhCa1dFZFVTMEZsUVVSSE5XUnJVWGMyU1VsamRURkNiMU1sTWtKeVVrSmtXR1Y1YzJORU4zVWxNa0pDU2xkaVdtZFVZVGRwZVU1RWIzazRSMm8yVmpSeGJFWXlSRlF5TlNVeVJrcGpTbHA0VFRSa05HUlpWWEIzT1dNbE1rWWxNa1pGVEd0bmVWbG5KVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFVacGJtRnNWRzl5Y21WdWRGTmxkSFZ3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVtYVc1aGJIUnZjbkpsYm5RdVkyOXRKVEpHWkc5M2JteHZZV1J6SlRKR2JtVjNaWE4wTG1WNFpRPT0=

http://www.bundlecentralsign.com/c?x=iKvyDj2E8Tlqf1lja8n6BeAX9EgcMLJqAfiPXL8kCoY=&c=3gTLqjDZzrpKeJoNymCmBIxVOmFlulHUcvxmXLK3IGwfSWj9DnhBNzsX7JAVhnN/tHJyfzsZDQ8t2IWtaS7v HyfjWXwr7d/jszIqI/PjLhPlFYWU/IPgsZZ6aA6kYYTgtyd4j0DbtA8q4ezT5zgGFPh GIfX40zs139gBB384gzcFDfFZXu l/uskHL2gPY&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.conceptsguardbinaries.com/c?x=IiMn1w0u8LBN3jPQbS/vqPD1KRQhtqabu/a4F89TAuw=&c=art8Y50LBmMZ9adxLZAJcOQ2T7y/bUpAT/Og1/9PL/7uq5mDO3sgTleT3lIxw3LY0Vsl7pDeahaZ9Y7BaLKppc emawbabgbuzHhIFYknMD7byrx2LrpW5c9/YPT YYwJel5V/c/LD6q tym2AgcJmSb0Cj5FHEDk8OcriNrzFqf2HKLEd2HeBrkOStb1JwY&e=0&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

Remove finaltorrentsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.